Existing provably robust defenses:  All existing provably robust defenses [1]}, [2]}, [3]}, [4]}, [5]}, [6]}, [7]}, [8]}, [9]}, [10]}, [11]}, [12]}, [13]}, [14]}, [15]}, [16]}, [17]}, [18]}, [19]}, [20]} were designed for multi-class classification instead of multi-label classification. In particular, they can guarantee that a robust multi-class classifier predicts the same single label for an input or a label (e.g., the single ground truth label of the input) is among the top-\(k\)  labels predicted by a robust multi-class classifier. These defenses are sub-optimal for multi-label classification. Specifically, in multi-label classification, we aim to guarantee that at least some ground truth labels of an input are in the set of labels predicted by a robust multi-label classifier.
